Panos Gkatziroulis 🦄 @ipurple
Red/Purple Teamer | Blogger | Mod @ https://t.co/f4RyUGl0zb | https://t.co/nLrzzAcQw9 ipurple.team Internet Joined January 2012-
Tweets16K
-
Followers27K
-
Following823
-
Likes4K
An EDR evasion technique that leverages SendMessage with WM_SETTEXT for stealthy injection, bypassing direct calls to WriteProcessMemory, a frequently monitored API in modern EDR products. github.com/TwoSevenOneT/P…
1
1
16
665
12
View Details
From a defensive perspective, this technique can be detected by monitoring the following activities: 1⃣ Event ID 5 & 67 (Microsoft-Windows-User Profile Service) 2⃣ 7 (Offreg.dll) & 11 File Creation (.MAN) - Sysmon Emulation & Detection: ipurple.team/2026/08/11/man…
Swarmer - persistence that never touches the registry. It turns a .reg export into an NTUSER.MAN hive that Windows loads over a user's own hive, abusing legacy Mandatory User Profile behavior. No registry APIs are called, so EDR sees no writes, and it works without
WHFB-PinCapture - captures the PIN by placing a CPU hardware breakpoint on the function that packages the typed PIN inside LogonUI.exe, reading the argument from the trapped thread context in a Vectored Exception Handler, and letting the original, unmodified instruction execute, so the PIN login still succeeds normally. github.com/ivancabrera02/…
SyscallRevenant - a new method of performing clean indirect syscalls. The main component resolves System Service Numbers (SSNs) and syscall instruction addresses dynamically github.com/SilentisVox/Sy…
@init1security Any estimation on the price?
Panos Gkatziroulis 🦄 retweeted
If you want to learn how DLL Sideloading works, I wrote about it in 2023 when I was learning it myself. It's been around for a very long time. politoinc.com/post/playing-w…
DLL Sideloading for Initial Access and Bypassing Elastic EDR akchhat.gitbook.io/dev/initial-ac…
@IAMERICAbooted I still remember your article with the bubbles. Cool post!
TornadoC2 - Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64. github.com/kamalx06/Torna…
A red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer github.com/shaheeryasirof…
DLL Sideloading for Initial Access and Bypassing Elastic EDR akchhat.gitbook.io/dev/initial-ac…
HostBadger - Read-only Windows host hardening auditor in PowerShell with optional AI analysis github.com/g4bri-3l3/Host…
Cobalt Strike Docker Container - a Docker container for running a Cobalt Strike Teamserver. github.com/chryzsh/docker…
After You’re In: Field Notes on CRTO Prep and OPSEC gikaku.net/2026/10/17/crt…
IDWolf - Read-only Active Directory & Microsoft Entra ID hygiene auditor in pure PowerShell. Collect once, analyze offline: deterministic findings, attack paths, NIS2/ISO 27001/DORA/GDPR mapping, HTML/CSV/JSONL reports, optional AI analysis github.com/g4bri-3l3/IDWo…
Detection Versioning: The evolution of logic and intent by @alehurtadoxo nebulock.io/blog/detection…
Apex - a C2 framework with a native agentic AI operator interface. Connect any MCP-compatible LLM (Claude Code, Cursor, Codex) to the teamserver via a scoped token, and it can enumerate targets, author and upload modules, run them, read results, and adapt its next move based on this information. phantomsec.tools/blog/apex-c2-v…
ReflectivePluginLoader - Maps a DLL from a byte buffer in memory, resolves exports, and calls plugin functions either from anonymous memory (classic reflective load) or from inside a legitimately loaded sacrificial DLL (module stomping). github.com/racoten/Reflec…
Panos Gkatziroulis 🦄 retweeted
A little writeup on how amsi bypass, etw bypass & FullLanguageMide on a custom powershell runspace works by7e.dev/blog/runspace
Panos Gkatziroulis 🦄 retweeted
Florian Roth ⚡️ @cyb3rops
225K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Justin Elze @HackingLZ
74K Followers 5K Following CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
Grzegorz Tworek @0gtweet
39K Followers 2K Following My own research, unless stated otherwise. Not necessarily "safe when taken as directed". GIT d- s+: a+ C++++ !U !L !M w++++$ b++++ G-
DirectoryRanger @DirectoryRanger
37K Followers 108 Following This account assembles and disseminates information related to Active Directory and Windows security.
Vincent Yiu @vysecurity
32K Followers 414 Following Director of Red Team, Offensive Security, Agentic Super Intelligence. Helping organizations safeguard their businesses from the bad guys.
☣ KitPloit - Hacker... @KitPloit
119K Followers 3K Following Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
Oliver Lyak @ly4k_
9K Followers 268 Following Yet another security researcher 🔦 Github: https://t.co/7WFOFz17KI
sn🥶vvcr💥sh @snovvcrash
12K Followers 492 Following Sr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
rootsecdev @rootsecdev
27K Followers 1K Following Senior Security Consultant @TrustedSec | Military grade meme poster, researcher, cloud penetration tester, voider of warranties. My thoughts are my own.
an0n @an0n_r0
14K Followers 734 Following CRT(E|O|L) | OSCP | @RingZer0_CTF 1st (for 2yrs) | HackTheBox Top10 | RPISEC MBE | Flare-On completer | GoogleCTF writeup winner | SSD research | Math MSc |🇭🇺
mgeeky | Mariusz Bana... @mariuszbit
15K Followers 1K Following 🔴 Offensive Security Developer @ Outflank, Red Team operator, ex-AV dev, ex- malware researcher 🫖 Green tea lover
DebugPrivilege @DebugPrivilege
41K Followers 2K Following Not active anymore on X. Network Defender. Problem solver with a passion for troubleshooting complex issues.
Stephan Berger @malmoeb
30K Followers 1K Following Head of Investigations @InfoGuardAG https://t.co/A5lnFAu7eX
Will Dormann is on Ma... @wdormann
27K Followers 1K Following I play with vulnerabilities and exploits. I used to be here on Twitter but now I'm here: @[email protected] https://t.co/hXggdAVkSQ
SEKTOR7 Institute @SEKTOR7net
17K Followers 348 Following Homo Aptus. Vincit qui se vincit - Publilius Syrus. Consulting, Training, Technology, Cyber domain, and more... @x33fcon founder.
Nikhil @Ox4d5a
19K Followers 2K Following Penetration Tester | i XCHG 0's 1's and do hacks | Red Team Sorcery https://t.co/6LUhkvN2hz | #eJPT | #OSCP | #CRTP | #CRTA | #CESP | #CRTE
Jean @Jean_Maes_1994
12K Followers 1K Following @sansoffensive Certified instructor/SEC565 author/SEC699 co author https://t.co/cp5DerI3g4
n00py @n00py1
14K Followers 966 Following Retweeter of InfoSec/Offsec/Pentest/Red Team. Occasional blogger/Independent security research.
pu3zle @pu3zle
7 Followers 259 Following
Ümit Demirci @umitdemirci94
2 Followers 620 Following
mihoyo @mihoyo1082437
1 Followers 30 Following
Johan @Johan52535404
0 Followers 86 Following
go joy @gojoy14
9 Followers 151 Following
blazingcactus31 @blazingcactus31
0 Followers 347 Following
π @l3sbq
5 Followers 106 Following
john @sectruejohn
2 Followers 12 Following
Init1Security @init1security
1K Followers 82 Following Elevating security with expert offensive strategies
Lexon @Lexon1973470
2 Followers 136 Following
James Hooker @g0blinResearch
6K Followers 2K Following Developer, turned security advocate - OSCP, BRDY, GNGR. Co-founder of @hackthebox_eu. My thoughts are my own.
Vias Tecno @ViasTecno
0 Followers 111 Following
twentysick @Just_Twentysick
19 Followers 464 Following Just a nỏmal Ưindow user Interested in Malware slop ------------------ Github: https://t.co/fzsG0AgKHu Gitbook: https://t.co/VCDboqUObT
Steven Vianney @Vixv49
0 Followers 57 Following
1韩璐阳 @LeonH888888
1 Followers 43 Following
Gokul Kannappan @Jim4mypam
1 Followers 22 Following
wang Mr @wang_mou01
15 Followers 156 Following
Jimmy Smith @JimmySmithstqa
9 Followers 149 Following
徐日凯 @sx3oto
1 Followers 99 Following
django88 @django88_
178 Followers 234 Following Red Teamer and Senior Security Research Engineer at @Elastic
Fuck You Twittِer @FuckTwi_tt_er
59 Followers 3K Following
Felix Zhang @FelixZhang958
16 Followers 152 Following
Mc_Caine 117 @mcclaine117
139 Followers 2K Following
bruce @brucr2017
37 Followers 1K Following
kimssam @gimi_won
15 Followers 49 Following
Kevin Birkoff @B370r0font3
43 Followers 1K Following
Hypvice @Hypvicezs
2 Followers 53 Following
Ryan “DM” Sith @DarthMaulware
1K Followers 2K Following Threat Researcher-Lead, krav maga and MBC/CBC practitioner, hip hop junkie and StarWars nerd. Thoughts are my own and reflect my employer. #Resilience #Darkside
Pharis ahmed Yahya @Pharezzee
5 Followers 486 Following
Halen Hell @halen_hell
0 Followers 1K Following
machinageist @machinageist
26 Followers 2K Following learning in public at https://t.co/PDsoCIGbHw and https://t.co/U4GHTLsubC
sunlightrain @sunlightrain2
72 Followers 1K Following #VMware #Veeam #Homelab #Storage #VCP #VCAP #HCIA #K8S #KVM #SDS #SDDC
Jorge @14jrsg
0 Followers 96 Following
Konstantin @Konnl67
0 Followers 101 Following
... @int_tr_
90 Followers 3K Following Gündemi ve ilgi alanlarımı takip etmek için kullanıyorum. Sık tweet atılmaz, atılırsa da bir süre sonra imha edilir.
Omar Salazar @TaurusOmar_
2K Followers 92 Following Cybersecurity Research - Vulnerability Research - Exploit Developer - Haskell, Go & C - Power User Unix / Linux Kernel - WebSecurity
2_F4c3 @2_f4c3
3 Followers 70 Following
SaiTeja @crysis939386
549 Followers 5K Following Cloud security architect, 13+ yrs. Detection engineering, DFIR, AI security. I post what defenders should check today, with sources. No vendor slides.
GodlikeTCE @GodTCE
7 Followers 781 Following
Ahmed Elzeky @0xZiki
2 Followers 83 Following Cybersecurity Software Engineer & Systems Architect | Author: Active Directory Protocol Internals (Vol 1) | Network tools & AD Internals | CS @ Mansoura
Florian Roth ⚡️ @cyb3rops
225K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Justin Elze @HackingLZ
74K Followers 5K Following CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
Grzegorz Tworek @0gtweet
39K Followers 2K Following My own research, unless stated otherwise. Not necessarily "safe when taken as directed". GIT d- s+: a+ C++++ !U !L !M w++++$ b++++ G-
chompie @chompie1337
91K Followers 1K Following hacker, exploit developer/weird machine mechanic head of X-Force Offensive Research (XOR) @IBM
5pider @C5pider
36K Followers 143 Following research & development @InfinityXCurve | personal blog: https://t.co/4gzLz0Z26z
Adam Chester 🏴�... @_xpn_
40K Followers 560 Following TRACE at @SpecterOps | Blog at https://t.co/tjfTOllCEu
DirectoryRanger @DirectoryRanger
37K Followers 108 Following This account assembles and disseminates information related to Active Directory and Windows security.
Mike Felch (Stay Read... @ustayready
18K Followers 2K Following Offensive @ TrustedSec | Hacking since Renegade BBS backdoors | Prior CrowdStrike/BHIS | In Christ's grip | Fighter for truth | K1HAQ | RE/VR/ED
sn🥶vvcr💥sh @snovvcrash
12K Followers 492 Following Sr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
an0n @an0n_r0
14K Followers 734 Following CRT(E|O|L) | OSCP | @RingZer0_CTF 1st (for 2yrs) | HackTheBox Top10 | RPISEC MBE | Flare-On completer | GoogleCTF writeup winner | SSD research | Math MSc |🇭🇺
mgeeky | Mariusz Bana... @mariuszbit
15K Followers 1K Following 🔴 Offensive Security Developer @ Outflank, Red Team operator, ex-AV dev, ex- malware researcher 🫖 Green tea lover
Josh @passthehashbrwn
10K Followers 294 Following Adversarial Simulation at IBM, tweets are mine etc.
DebugPrivilege @DebugPrivilege
41K Followers 2K Following Not active anymore on X. Network Defender. Problem solver with a passion for troubleshooting complex issues.
Will Dormann is on Ma... @wdormann
27K Followers 1K Following I play with vulnerabilities and exploits. I used to be here on Twitter but now I'm here: @[email protected] https://t.co/hXggdAVkSQ
Rad @rad9800
10K Followers 88 Following building solutions to secure worlds. all thoughts / opinions (if at all) are my own. labs @thinkstcanary - prev. founder @deceptiq_ (acq.)
SEKTOR7 Institute @SEKTOR7net
17K Followers 348 Following Homo Aptus. Vincit qui se vincit - Publilius Syrus. Consulting, Training, Technology, Cyber domain, and more... @x33fcon founder.
Yarden Shafir @yarden_shafir
27K Followers 332 Following A circus artist with a visual studio license
Penelope Gkioni @PenelopeGioni
249 Followers 477 Following sports journalist, athletics fan, senior communications // Gazzetta , GWomen
Threat Hunting Labs @ThruntingLabs
3K Followers 1 Following Train on raw telemetry from actual breaches. Investigate malware and reconstruct the kill chain from process creation to exfiltration and beyond.
MalbearLabs @MalbearLabs
516 Followers 7 Following We have one mission: research threats, fight cybercrime, educate everyone. Feel free to DM us or email: [email protected]
Init1Security @init1security
1K Followers 82 Following Elevating security with expert offensive strategies
Velkris @warped_atom
30 Followers 240 Following 0x01 :: 52 65 64 20 54 65 61 6d 0x02 :: 50 65 6e 74 65 73 74 65 72 0x03 :: 4f 66 66 65 6e 73 69 76 65 20 44 65 76
sydney @letswastetime
597 Followers 359 Following `thrunter` | opinions != employers | she/her | search "thrunting soundtrack" | eval link="https://t.co/7EA1367cqG"
Jose Enrique Hernande... @_josehelps
4K Followers 2K Following ⚔️Prevention Engineering @MagicSwordIO | Ex-@Splunk Threat Research Dir. | Co-creator #LOLDrivers #LOLRMM | Maintainer #AtomicRedTeam #LOLBAS 🤿
MacSec Labs @MacSecLabs
394 Followers 17 Following Advanced hands-on macOS security training. Red team tradecraft, reverse engineering, exploitation & evasion. Built by operators, for operators
Synacktiv @Synacktiv
22K Followers 274 Following Offensive security company. Dojo of many ninjas. Red teaming, reverse engineering, vuln research, dev of security tools and incident response.
spencer @techspence
19K Followers 3K Following 🛠️ Former Sysadmin, now Pentester | Microsoft MVP | Helping IT teams make their environment harder to attack | @SecurIT360 & @CyberThreatPOV
Eric Capuano - Bsky: ... @eric_capuano
11K Followers 3K Following Co-Founder @recon_infosec | SANS DFIR Instructor | IANS Faculty | https://t.co/yUXCSu2Yso | ⬡ ❤ @shortxstack
Rémi GASCOU (Podalir... @podalirius_
8K Followers 751 Following Senior Security Researcher @SpecterOps | 5 x Microsoft MVP | Creator of opensource security tools 🎬 https://t.co/QaAENc5l2w | Views are my own
Kurosh Dabbagh @_Kudaes_
1K Followers 198 Following nt authority\kurosh https://t.co/MCEI38ndVE https://t.co/w6aiUt7YlZ
Ionut Popescu @NytroRST
4K Followers 4K Following Interested in C/C++, ASM, Windows internals, reverse engineering, exploit & shellcode development and advanced web exploitation. GitHub: https://t.co/nyWUyFo0KW
Asuka Nakajima | 中�... @AsuNa_jp
11K Followers 996 Following Senior Security Research Engineer @Elastic / BlackHat USA & Asia Review Board / CTF for GIRLS / 著書『サイバー攻撃』/ サイバーセキュリティに関する総務大臣奨励賞 / My tweets are my own opinion
Blu Raven Academy @BluRavenSec
454 Followers 11 Following Learn Threat Hunting, Detection Engineering, DFIR, and KQL at https://t.co/EM8t7XaU3Q #ThreatHunting, #DetectionEngineering, #DFIR, #KQL
Scriptmonkey_ @scriptmonkey_
1K Followers 1K Following Tester of Pens, Ex-Teamer of Red things, now with a more purpley shade. Biker and Recovering Eve-Online Addict. o7 Astro Instagram: https://t.co/okwgH30GtJ
John Hammond @_JohnHammond
328K Followers 3K Following Cybersecurity Researcher @HuntressLabs Just Hacking Training @JustHackingHQ w/ @ethicalhacker https://t.co/UtsNJiyiEk && https://t.co/narO3syzIy
Offensys @offensys
153 Followers 0 Following Offensys provides a platform to validate your security controls against realistic, behavior-based attack simulations.
Silky @S1lky_1337
2K Followers 477 Following German IT-Security Researcher | 𝐎𝐒𝐄𝐏 | 𝐎𝐒𝐂𝐏 | 𝐂𝐑𝐓𝐏 | 𝐂𝐄𝐓𝐏 | Pentester | Freetime Malware Dev
CodeX @codex_tf2
2K Followers 219 Following advanced persistent clown 🤡 📕 redteam blog: https://t.co/ihAv2kFvUj 🛠️ github: https://t.co/VhmOUAVF3R opinions are my own
Rtl Dallas @RtlDallas
686 Followers 212 Following
Bert-Jan 🛡️ @BertJanCyber
5K Followers 631 Following Defensive Security Expert | Microsoft Security MVP | https://t.co/Tu1l2ZFe0T
Nick VanGilder @nickvangilder
4K Followers 3K Following Director of Offensive Security Operations at Fortune 500 Bank
Filip Dragovic @filip_dragovic
8K Followers 1K Following My research unless stated otherwise. My opinions are my own and do not represent the views of my employer. Red Team @MDSecLabs
K̵i̵r̵k̵ ̵T̵r̵... @Teach2Breach
2K Followers 782 Following I design malware. I write about malware. I share malware. I seek to align my efforts with God, family, and country.
NCV @nickvourd
1K Followers 386 Following Just your friendly neighborhood APT:~# OSCE³ Opinions are my own and not the views of my employer.
Kostas @Kostastsale
21K Followers 516 Following I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦
Emeric Nasi @EmericNasi
5K Followers 422 Following CyberSecurity researcher and founder of BallisKit. I have a passion for all infosec subjects especially redteam and writing offensive tools!
Uriel Kosayev @UrielKosayev
6K Followers 432 Following Author of MAoS - Malware Analysis on Steroids & Antivirus Bypass Techniques | Cybersecurity Researcher | Keynote Speaker | Co-Founder @TrainSec Academy
Will @BushidoToken
39K Followers 3K Following Senior Threat Intel Advisor @TeamCymru Co-founder @CuratedIntel Co-author @SANSForensics FOR589 Co-founder @BSidesBournemth #126: REvil @darknetdiaries
Steve S. @0xTriboulet
5K Followers 2K Following Cybersecurity Researcher | USN, USMC Veteran | USNA '19
Shawn @anthemtotheego
2K Followers 423 Following CTO & Co-Founder @RemoteThreat | Ex Head of Capability R&D Adversary Sim X-Force | Offensive AI | Malware | Work In Progress | https://t.co/eNspx7jLvm
Two Seven One Three @TwoSevenOneT
6K Followers 125 Following Chief Security Officer (CSO) || Security Researcher at https://t.co/YsorB5YEAu || Penetration Tester || Red Teamer || Social Engineering Awareness Trainer
Hope Walker @Icemoonhsv
1K Followers 176 Following Principal Consultant at @SpecterOps. All opinions are my own.Trends for United States
You might like
Will Schroeder
@harmj0y
50K Followers
DirectoryRanger
@DirectoryRanger
37K Followers
/r/netsec
@_r_netsec
34K Followers
Marcello
@byt3bl33d3r
30K Followers
🥝🏳️🌈 Be...
@gentilkiwi
63K Followers
SpecterOps
@SpecterOps
42K Followers
Adam Chester 🏴�...
@_xpn_
40K Followers
Lee Chagolla-Christen...
@tifkin_
14K Followers
S3cur3Th1sSh1t
@ShitSecure
29K Followers
Chetan Nayak (Brute R...
@NinjaParanoid
32K Followers
Sean Metcalf
@PyroTek3
37K Followers
hasherezade
@hasherezade
92K Followers
Rasta Mouse
@_RastaMouse
50K Followers
Orange Tsai 🍊
@orange_8361
66K Followers
Ryan Cobb
@cobbr_io
12K Followers